What’s Vulnerable › Vulnerabilities

CVE-2026-111497: Out-of-Bounds Write in Google Brotli Decoder

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-10-27
• EPSS: 82.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-30
• Weakness: CWE-252

Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Summary

CVE-2026-111497 is a critical out-of-bounds write in the Brotli decoder (c/dec/decode.c) affecting Google Brotli versions 1.0.3 through 1.2.0 on all platforms. A remote unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS estimates a 36.0% probability of exploitation in 30 days. Update Brotli libraries and binaries to 1.0.10, 1.1.1, or 1.2.1, and follow CISA BOD 26-04 guidance, including evaluating internet exposure and applying forensics triage requirements.

CVE-2026-111497 هو ثغرة كتابة خارج الحدود (out-of-bounds write) حرجة في مفكك ترميز Brotli (الملف c/dec/decode.c) تؤثر على إصدارات Google Brotli من 1.0.3 حتى 1.2.0 على جميع المنصات. يستطيع مهاجم بعيد غير مصادق عليه إرسال تدفق Brotli مضغوط مصمم خصيصًا لإفساد ذاكرة حالة المفكك المجاورة، أو كشف محتويات ذاكرة حساسة، أو التسبب في حجب الخدمة، أو احتمال تنفيذ تعليمات برمجية عشوائية. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة المستغلة مع استغلال نشط، وتقدّر EPSS احتمال الاستغلال خلال 30 يومًا بنسبة 36.0%. يجب تحديث مكتبات وبرامج Brotli إلى الإصدار 1.0.10 أو 1.1.1 أو 1.2.1، واتباع إرشادات CISA BOD 26-04 بما في ذلك تقييم التعرض للإنترنت وتطبيق متطلبات الفرز الجنائي.

Affected products

• 7-Zip P7Zip: through 16.02
• Andybalholm Brotli: before 1.2.7 — fixed in 1.2.7
• Anthropic Bun: before 1.4.4 — fixed in 1.4.4
• Apache Software Foundation Apache Arrow: through 26.0.0; 27.0.0-dev
• ClickHouse: through 26.10.2.103
• Debian Linux: 12.0 (and their updates)
• duckdb: through 2.0.0
• envoyproxy envoy: before 1.37.8; from 1.38.0 before 1.38.6; from 1.39.0 before 1.39.3 — fixed in 1.37.8, 1.38.6, 1.39.3
• Google Brotli: from 1.0.3 before 1.0.10; from 1.1.0 before 1.1.1; from 1.2.0 before 1.2.1 — fixed in 1.0.10, 1.1.1, 1.2.1
• Google Woff2: all versions
• istio: before 1.29.9; from 1.30.0 before 1.30.6; from 1.31.0 before 1.31.2 — fixed in 1.29.9, 1.30.6, 1.31.2
• Mcmilk 7-Zip-Zstd: through 26.02-1.5.7-r2
• Microsoft .NET: from 8.0.0 before 8.0.33; from 9.0.0 before 9.0.22; from 10.0.0 before 10.0.14; 11.0.0-preview1, 11.0.0-preview2, 11.0.0-preview3, 11.0.0-preview4, 11.0.0-preview5, 11.0.0-preview6 (+3) — fixed in 8.0.33, 9.0.22, 10.0.14
• Node.js: before 22.23.4; from 23.0.0 before 24.22.1; from 25.0.0 before 26.12.1 — fixed in 22.23.4, 24.22.1, 26.12.1
• Python-Hyper Brotlicffi: before 1.2.1.0 — fixed in 1.2.1.0
• Siemens Common Configurator: all versions
• Siemens Data Flow Monitoring: all versions
• Siemens Edge Opc Ua Server Configurator: all versions
• Siemens Flow Creator Configurator: all versions
• Siemens Industrial Edge Cloud Connector Configurator: all versions
• Siemens Industrial Edge Databus Configurator: all versions
• Siemens Industrial Edge Hub: all versions
• Siemens Industrial Edge Management Cloud: all versions
• Siemens Ruggedcom Ape1808 Firmware: all versions
• TianoCore edk2: through 202608
• Pypi Brotli: from 1.0.3 before 1.2.1; 1.0.4, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0 (+1) — fixed in 1.2.1
• Pypi Brotlicffi: from 1.0.3 before 1.2.1.0; 1.0.9.0, 1.0.9.1, 1.0.9.2, 1.1.0.0, 1.2.0.0, 1.2.0.1 (+1) — fixed in 1.2.1.0
• Google Brotli: from 1.0.3 before 1.0.10; from 1.1.0 before 1.1.1; from 1.2.0 before 1.2.1 — fixed in 1.0.10, 1.1.1, 1.2.1

How to fix

Upgrade to a fixed version: Andybalholm Brotli 1.2.7; Anthropic Bun 1.4.4; envoyproxy envoy 1.37.8, 1.38.6, 1.39.3; Google Brotli 1.0.10, 1.1.1, 1.2.1; istio 1.29.9, 1.30.6, 1.31.2; Microsoft .NET 8.0.33, 9.0.22, 10.0.14; Node.js 22.23.4, 24.22.1, 26.12.1; Python-Hyper Brotlicffi 1.2.1.0; Pypi Brotli 1.2.1; Pypi Brotlicffi 1.2.1.0; Google Brotli 1.0.10, 1.1.1, 1.2.1. Check the vendor advisory for mitigations.

In the news

• Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability
• CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
• Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
• Vulnerabilities in node.js Affecting Cisco Products: October 2026
• Brotli bug reaches far beyond Node.js (CVE-2026-111497)
• Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
• CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)
• PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

References

• https://github.com/andybalholm/brotli/releases/tag/v1.2.7
• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high
• http://www.openwall.com/lists/oss-security/2026/10/23/25
• http://www.openwall.com/lists/oss-security/2026/10/24/6
• http://www.openwall.com/lists/oss-security/2026/10/26/12
• http://www.openwall.com/lists/oss-security/2026/10/26/13
• http://www.openwall.com/lists/oss-security/2026/10/26/16
• https://broccoli2shell.com
• https://github.com/advisories/GHSA-9v8h-qqgm-4m35
• https://github.com/dotnet/announcements/issues/494
• https://github.com/google/brotli/releases/tag/v1.0.10
• https://github.com/google/brotli/releases/tag/v1.1.1

Get alerted when CVE-2026-111497 or the next vulnerability affects your stack